CVE-2026-66633WordPress Fluent Forms Pro Add On Pack plugin < 6.2.12 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product F Fluent Forms Pro Add On Pack Published 08/18/2026 Severity High CVE-2026-73532Fluent Forms Pro 6.2.7 Embedded Malicious Code via Tampered Plugin Build Exploitation status Not known exploited Fix Not confirmed Affected product F Fluent Forms Pro Published 08/13/2026 Severity Critical CVE-2026-73533Ninja Tables Pro 5.2.11 Embedded Malicious Code via Tampered Plugin Build Exploitation status Not known exploited Fix Not confirmed Affected product N Ninja Tables Pro Published 08/13/2026 Severity Critical CVE-2026-66467WordPress FluentCommunity plugin <= 2.7.5 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product F FluentCommunity Published 08/13/2026 Severity Medium CVE-2026-18146Fluent Forms <= 6.2.11 - Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values Exploitation status Not known exploited Fix Affected product F Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Published 08/13/2026 Severity High CVE-2026-61964WordPress Ninja Tables plugin <= 5.2.9 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product N Ninja Tables Published 08/06/2026 Severity High CVE-2026-16636FluentSMTP <= 2.2.95 - Unauthenticated Stored Cross-Site Scripting via Recipient Display Name (to.name) in Email Logs Exploitation status Not known exploited Fix Affected product F FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, Mailgun, Postmark, Cloudflare, toSend, Gmail and Any SMTP Published 08/06/2026 Severity High CVE-2026-17571Fluent Forms <= 6.2.8 - Reflected Cross-Site Scripting via 'param' Exploitation status Not known exploited Fix Affected product F Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Published 08/01/2026 Severity Medium CVE-2026-17567Fluent Forms <= 6.2.8 - Unauthenticated Sensitive Information Exposure via Insecure Direct Object Reference and Weak Transaction Hash in 'transaction' Parameter Exploitation status Not known exploited Fix Affected product F Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Published 07/31/2026 Severity Medium CVE-2026-16655Fluent Forms <= 6.2.7 - Unauthenticated Stored Cross-Site Scripting via Name Field Nested `password` Member Exploitation status Not known exploited Fix Affected product F Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Published 07/29/2026 Severity High CVE-2026-15665Fluent Support <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'redirect-to' Shortcode Attribute Exploitation status Not known exploited Fix Affected product F Fluent Support – Helpdesk & Customer Support Ticket System Published 07/24/2026 Severity Medium CVE-2026-65474WordPress Ninja Tables plugin <= 5.2.10 - Sensitive Data Exposure vulnerability Exploitation status Not known exploited Fix Affected product N Ninja Tables Published 07/23/2026 Severity Medium CVE-2026-65470WordPress Fluent Support plugin <= 2.3.0 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product F Fluent Support Published 07/23/2026 Severity Medium CVE-2026-57715WordPress Fluent CRM plugin <= 3.1.7 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product F Fluent CRM Published 07/13/2026 Severity High CVE-2026-5069Fluent Forms <= 6.2.1 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Subscription Cancellation via 'subscription_id' Exploitation status Not known exploited Fix Affected product F Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Published 07/10/2026 Severity Medium CVE-2026-42655WordPress Best Payments Plugin for WP plugin <= 4.6.19 - Payment Bypass vulnerability Exploitation status Not known exploited Fix Affected product B Best Payments Plugin for WP Published 06/15/2026 Severity High CVE-2025-67971WordPress FluentCart plugin < 1.3.0 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product F FluentCart Published 02/20/2026 Severity High CVE-2025-13495FluentCart A New Era of eCommerce <= 1.3.1 - Authenticated (Administrator+) SQL Injection via 'groupKey' Parameter Exploitation status Not known exploited Fix Affected product F FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler Published 12/03/2025 Severity Medium CVE-2025-2940Ninja Tables – Easy Data Table Builder <= 5.0.18 - Unauthenticated Server-Side Request Forgery Exploitation status Not known exploited Fix Affected product N Ninja Tables – Easy Data Table Builder Published 06/27/2025 Severity High CVE-2025-2939Ninja Tables – Easy Data Table Builder <= 5.0.18 - Unauthenticated PHP Object Injection to Limited Remote Code Execution Exploitation status Not known exploited Fix Affected product N Ninja Tables – Easy Data Table Builder Published 06/03/2025 Severity Medium CVE-2024-13568Fluent Support – Helpdesk & Customer Support Ticket System <= 1.8.5 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory Exploitation status Not known exploited Fix Affected product F Fluent Support – Helpdesk & Customer Support Ticket System Published 03/01/2025 Severity High CVE-2024-12772Ninja Tables < 5.0.17 - Admin+ Stored XSS Exploitation status Public exploit Fix Affected product N Ninja Tables Published 01/31/2025 Severity Medium CVE-2024-51796WordPress Trendy Restaurant Menu plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product T Trendy Restaurant Menu Published 11/19/2024 Severity Medium CVE-2024-47302WordPress Fluent Support plugin <= 1.8.0 - Broken Access Control on Email Verification vulnerability Exploitation status Not known exploited Fix Affected product F Fluent Support Published 11/01/2024 Severity Medium CVE-2024-47304WordPress Fluent Support plugin <= 1.8.0 - SQL Injection vulnerability Exploitation status Not known exploited Fix Affected product F Fluent Support Published 10/17/2024 Severity High CVE-2024-7304Ninja Tables – Easiest Data Table Builder <= 5.0.12 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload Exploitation status Not known exploited Fix Affected product N Ninja Tables – Easy Data Table Builder Published 08/27/2024 Severity Medium CVE-2024-23504WordPress Ninja Tables plugin <= 5.0.5 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product N Ninja Tables Published 06/14/2024 Severity Medium CVE-2024-23503WordPress Ninja Tables plugin <= 5.0.6 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product N Ninja Tables Published 06/11/2024 Severity Medium CVE-2024-35635WordPress Ninja Tables plugin <= 5.0.9 - Server Side Request Forgery (SSRF) vulnerability Exploitation status Not known exploited Fix Affected product N Ninja Tables Published 06/03/2024 Severity Medium CVE-2024-30430WordPress FluentCRM plugin <= 2.8.44 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product F Fluent CRM Published 03/29/2024 Severity Medium CVE-2023-6953PDF Generator For Fluent Forms <= 1.1.7 - Cross-Site Scripting Exploitation status Not known exploited Fix Affected product F Fluent PDF Generator Published 02/05/2024 Severity Medium CVE-2023-51547WordPress Fluent Support Plugin <= 1.7.6 is vulnerable to SQL Injection Exploitation status Not confirmed Fix Affected product F Fluent Support – WordPress Helpdesk and Customer Support Ticket Plugin Published 12/31/2023 Severity High CVE-2023-3087FluentSMTP <= 2.2.4 - Unauthenticated Stored Cross-Site Scripting via Email Subject Exploitation status Not known exploited Fix Affected product F FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider Published 07/12/2023 Severity High CVE-2023-1430FluentCRM - Marketing Automation For WordPress <= 2.8.01 - Insufficient Use of Hash as Authorization Control Exploitation status Not known exploited Fix Affected product F FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution Published 06/09/2023 Severity Medium CVE-2022-47136WordPress Ninja Tables Plugin <= 4.3.4 is vulnerable to Cross Site Request Forgery (CSRF) Exploitation status Not known exploited Fix Affected product N Ninja Tables – Best Data Table Plugin for WordPress Published 05/25/2023 Severity Medium CVE-2022-47137WordPress Ninja Tables Plugin <= 4.3.4 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not known exploited Fix Affected product N Ninja Tables Published 05/10/2023 Severity Medium CVE-2023-0219FluentSMTP < 2.2.3 - Stored XSS via Email Logs Exploitation status Public exploit Fix Affected product F FluentSMTP Published 03/13/2023 Severity Unknown CVE-2022-4746FluentAuth < 1.0.2 - Bypass blocks by IP Spoofing Exploitation status Public exploit Fix Affected product F FluentAuth Published 01/23/2023 Severity High CVE-2022-2559Fluent Support < 1.5.8 - Admin+ SQLi Exploitation status Not confirmed Fix Affected product F Fluent Support – WordPress Helpdesk and Customer Support Ticket Plugin Published 08/29/2022 Severity Unknown CVE-2022-2544Ninja Job Board < 1.3.3 - Resume Disclosure via Directory Listing Exploitation status Not confirmed Fix Affected product N Ninja Job Board – Ultimate WordPress Job Board Plugin Published 08/22/2022 Severity Unknown CVE-2021-24900Ninja Tables < 4.1.8 - Admin+ Stored Cross-Site Cross-Site Scripting Exploitation status Not confirmed Fix Affected product N Ninja Tables – Best WP DataTables Plugin for WordPress Published 02/01/2022 Severity Unknown CVE-2021-24528FluentSMTP < 2.0.1 - Authenticated Stored XSS Exploitation status Not confirmed Fix Affected product F FluentSMTP – WordPress Mail SMTP, SES, SendGrid, Mailgun and Any SMTP Plugin Published 08/30/2021 Severity Unknown 
